# @summary A short summary of the purpose of this class
#
# A description of what this class does
#
# @example
#   include lzu::login9
class lzu::login9 (
  $enable_masquerade = false,
){

  $condor_pkg = [
      "condor",
      "condor-classads",
      "condor-kbdd",
      "condor-procd",
      "condor-externals",
      "python3-condor",
      "python3-scitokens",
  ]
  yumrepo { "condor":
    baseurl => "http://${mirrorserver}/yum/condor/repo/10.x/el${operatingsystemmajrelease}/x86_64/release",
    descr => "condor",
    enabled => 1,
    gpgcheck => 0,
    priority => 20,
    before   => Yumrepo['site'],
  }

  package { $condor_pkg:
    ensure  => installed,
    require => Yumrepo['site'],
  } ->

  package {["krb5-workstation",]:
    ensure   => installed,
    require  => Yumrepo['site'],
  }->
  file { '/etc/krb5.conf':
    mode    =>  '0644',
    owner   =>  'root',
    group   =>  'root',
    source  =>  "puppet:///modules/${module_name}/krb5.conf",
  }
  sshd_config { 'KerberosAuthentication':
    ensure => present,
    value  => 'yes',
    notify => Service['sshd'],
  }
  class { 'firewalld': }
  firewalld_zone { 'public':
    ensure           => present,
    purge_rich_rules => true,
    purge_services   => true,
    purge_ports      => true,
    masquerade       => $enable_masquerade,
  }
  if $enable_masquerade {
    sysctl { "net.ipv4.ip_forward":
      ensure => present,
      value  => "1",
      target => "/etc/sysctl.d/ipforward.conf",
    }
  }
    firewalld_service { 'Allow ssh from the external zone':
      ensure  => 'present',
      service => 'ssh',
      zone    => 'public',
    }
    firewalld_rich_rule { 'Accept from IHEP4':
      ensure => present,
      zone   => 'public',
      source => '10.104.0.0/16',
      action  => 'accept',
    }
    firewalld_rich_rule { 'Accept from IHEP1':
      ensure => present,
      zone   => 'public',
      source => '202.122.32.0/21',
      action  => 'accept',
    }
    firewalld_rich_rule { 'Accept from IHEP2':
      ensure => present,
      zone   => 'public',
      source => '202.38.128.0/23',
      action  => 'accept',
    }
    firewalld_rich_rule { 'Accept from IHEP3':
      ensure => present,
      zone   => 'public',
      source => '210.72.16.0/25',
      action  => 'accept',
    }

    firewalld_rich_rule { 'Accept from local':
      ensure => present,
      family => 'ipv6',
      zone   => 'public',
      source => '2401:de00::/32',
      action  => 'accept',
    }
}
